ProFTPD _xlate_ascii_write() Buffer Overrun Vulnerability
BID:9782
Info
ProFTPD _xlate_ascii_write() Buffer Overrun Vulnerability
| Bugtraq ID: | 9782 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-0346 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 02 2004 12:00AM |
| Updated: | Nov 05 2007 03:25PM |
| Credit: | Discovery is credited to "Phantasmal Phantasmagoria" <[email protected]>. |
| Vulnerable: |
Turbolinux Turbolinux Workstation 8.0 Turbolinux Turbolinux Workstation 7.0 Turbolinux Turbolinux Server 8.0 Turbolinux Turbolinux Server 7.0 Turbolinux Appliance Server Workgroup Edition 1.0 Turbolinux Appliance Server 1.0 Workgroup Edition Redhat Linux 9.0 i386 Redhat Linux 8.0 i686 Redhat Linux 8.0 i386 Redhat Linux 8.0 Redhat Linux 7.3 i686 Redhat Linux 7.3 i386 Redhat Linux 7.3 Redhat Linux 7.2 noarch Redhat Linux 7.2 ia64 Redhat Linux 7.2 i686 Redhat Linux 7.2 i586 Redhat Linux 7.2 i386 Redhat Linux 7.2 athlon Redhat Linux 7.2 alpha Redhat Linux 7.2 Redhat Linux 7.1 k i386 Redhat Linux 7.1 pseries Redhat Linux 7.1 noarch Redhat Linux 7.1 iseries Redhat Linux 7.1 ia64 Redhat Linux 7.1 i686 Redhat Linux 7.1 i586 Redhat Linux 7.1 i386 Redhat Linux 7.1 alphaev6 Redhat Linux 7.1 alpha Redhat Linux 7.1 Redhat Linux 6.2 sparcv9 Redhat Linux 6.2 E sparc Redhat Linux 6.2 E i386 Redhat Linux 6.2 E alpha Redhat Linux 6.2 sparc Redhat Linux 6.2 i386 Redhat Linux 6.2 alpha Redhat Linux 6.2 ProFTPD Project ProFTPD 1.2.9 rc2 ProFTPD Project ProFTPD 1.2.9 rc1 ProFTPD Project ProFTPD 1.2.8 ProFTPD Project ProFTPD 1.2.7 Debian Linux 2.2 powerpc Debian Linux 2.2 IA-32 Debian Linux 2.2 arm Debian Linux 2.2 alpha Debian Linux 2.2 68k Debian Linux 2.2 |
| Not Vulnerable: |
ProFTPD Project ProFTPD 1.2.9 rc3 ProFTPD Project ProFTPD 1.2.9 |
Discussion
ProFTPD _xlate_ascii_write() Buffer Overrun Vulnerability
A remotely exploitable buffer overrun was reported in ProFTPD. This issue is due to insufficient bounds checking of user-supplied data in the '_xlate_ascii_write()' function, permitting an attacker to overwrite two bytes of memory adjacent to the affected buffer. The attacker may be able to exploit this to execute arbitrary code in the context of the server. The attacker may trigger this issue by submitting a RETR command to the server.
A remotely exploitable buffer overrun was reported in ProFTPD. This issue is due to insufficient bounds checking of user-supplied data in the '_xlate_ascii_write()' function, permitting an attacker to overwrite two bytes of memory adjacent to the affected buffer. The attacker may be able to exploit this to execute arbitrary code in the context of the server. The attacker may trigger this issue by submitting a RETR command to the server.
Exploit / POC
ProFTPD _xlate_ascii_write() Buffer Overrun Vulnerability
The researcher who discovered this issue has reportedly developed working exploit code that is not publicly available or known to be circulating in the wild at the time of writing.
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The researcher who discovered this issue has reportedly developed working exploit code that is not publicly available or known to be circulating in the wild at the time of writing.
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
ProFTPD _xlate_ascii_write() Buffer Overrun Vulnerability
Solution:
Please see the referenced advisories for more information.
ProFTPD Project ProFTPD 1.2.7
ProFTPD Project ProFTPD 1.2.8
Solution:
Please see the referenced advisories for more information.
ProFTPD Project ProFTPD 1.2.7
-
ProFTPD Project ProFTPD 1.2.9
http://proftpd.linux.co.uk/download.html -
Sun RaQ4-All-Security-2.0.1-16717.pkg
http://ftp.cobalt.sun.com/pub/packages/raqxtr/eng/RaQ4-All-Security-2. 0.1-16717.pkg -
Sun RaQXTR-All-Security-1.0.1-16717.pkg
http://ftp.cobalt.sun.com/pub/packages/raqxtr/eng/RaQXTR-All-Security- 1.0.1-16717.pkg -
Sun Qube3-All-Security-4.0.1-16717.pkg
http://ftp.cobalt.sun.com/pub/packages/qube3/ml/Qube3-All-Security-4.0 .1-16717.pkg
ProFTPD Project ProFTPD 1.2.8
-
ProFTPD Project ProFTPD 1.2.9
http://proftpd.linux.co.uk/download.html
References
ProFTPD _xlate_ascii_write() Buffer Overrun Vulnerability
References:
References:
- ProFTPD _xlate_ascii_write off-by-two exploit (CORE Security)
- ProFTPD Home Page (ProFTPD)
- ProFTPD Security Update 1.0.1 (Sun)
- ProFTPD Security Update 2.0.1 (Sun)
- ProFTPD Security Update 4.0.1 (Sun)
- The Cult of a Cardinal Number ("Phantasmal Phantasmagoria"